Hello community, here is the log from the commit of package csound for openSUSE:Factory checked in at Fri Jan 30 00:13:35 CET 2009. -------- --- csound/csound.changes 2008-10-01 15:28:59.000000000 +0200 +++ csound/csound.changes 2009-01-29 07:55:41.324733000 +0100 @@ -1,0 +2,7 @@ +Wed Jan 28 14:40:46 CET 2009 - tiwai@suse.de + +- Fix python module search path insecure issue (bnc#470095) + This package is unaffected; the patch is included just for any + possible cases in future. + +------------------------------------------------------------------- calling whatdependson for head-i586 New: ---- csound-sanitize-sys.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ csound.spec ++++++ --- /var/tmp/diff_new_pack.k28746/_old 2009-01-30 00:10:18.000000000 +0100 +++ /var/tmp/diff_new_pack.k28746/_new 2009-01-30 00:10:18.000000000 +0100 @@ -1,7 +1,7 @@ # # spec file for package csound (Version 5.06.0) # -# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2009 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -26,8 +26,8 @@ %endif Summary: Computer Sound Synthesis and Composition Program Version: 5.06.0 -Release: 128 -License: LGPL v2.1 or later +Release: 129 +License: GNU Free Documentation License, Version 1.2 (GFDL 1.2); LGPL v2.1 or later; X11/MIT Group: Productivity/Multimedia/Sound/Utilities Source: Csound%{version}.tar.bz2 Source1: README.SuSE @@ -35,6 +35,7 @@ Patch1: csound-tmpnam-fix.diff Patch2: csound-gcc-warning-fix.diff Patch3: csound-python-2.6-fix.diff +Patch4: csound-sanitize-sys.patch Url: http://www.csounds.com AutoReq: on Autoprov: off @@ -54,6 +55,7 @@ %patch1 %patch2 %patch3 +%patch4 -p1 cp %{SOURCE1} . # fix encoding iconv -f latin1 -t utf8 readme-csound5.txt > readme-csound5.txt.utf8 @@ -104,6 +106,10 @@ # %{_libdir}/lib* %changelog +* Wed Jan 28 2009 tiwai@suse.de +- Fix python module search path insecure issue (bnc#470095) + This package is unaffected; the patch is included just for any + possible cases in future. * Wed Oct 01 2008 tiwai@suse.de - fix build with python-2.6 * Wed Jun 20 2007 tiwai@suse.de ++++++ csound-sanitize-sys.patch ++++++ --- a/frontends/CsoundVST/Shell.cpp +++ b/frontends/CsoundVST/Shell.cpp @@ -211,6 +211,8 @@ namespace csound void Shell::main(int argc, char **argv) { PySys_SetArgv_(argc, argv); + /* Sanitize sys.path */ + PyRun_SimpleString_("import sys; sys.path = filter(None, sys.path)"); } void Shell::initialize() --- a/frontends/CsoundVST/ScoreGeneratorVst.cpp +++ b/frontends/CsoundVST/ScoreGeneratorVst.cpp @@ -427,6 +427,8 @@ Shell::open(); char *argv[] = {"",""}; PySys_SetArgv(1, argv); + /* Sanitize sys.path */ + PyRun_SimpleString("import sys; sys.path = filter(None, sys.path)"); PyObject *mainModule = PyImport_ImportModule("__main__"); result = runScript("import sys\n"); if(result) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org